- A GitHub account takeover campaign uses stolen tokens to inject malware into hundreds of Python repositories.
- The malicious code, part of the GlassWorm/ForceMemo campaign, targets users who clone or install from compromised repos.
- The payload retrieves instructions from a Solana wallet transaction memo, a signature linked to previous GlassWorm activity.
- Attackers rewrite Git history via force-pushing, leaving no visible trail in GitHub’s interface.
On March 8, 2026, the cybersecurity firm StepSecurity uncovered a sophisticated attack campaign compromising hundreds of Python repositories on GitHub by force-pushing malicious code. Dubbed ForceMemo, this offshoot of the ongoing GlassWorm malware operation exploits stolen developer credentials to alter project files and infect downstream users.
According to StepSecurity, the attackers target projects including Django apps and PyPI packages by appending obfuscated malware to key files. “Anyone who runs pip install from a compromised repo or clones and executes the code will trigger the malware,” the company said. This methodology rewrites Git history via rebasing, preserving original commit details to evade detection.
The injected payload contains checks to avoid systems with Russian locales. Consequently, it fetches its commands by querying the transaction memo of a specific Solana wallet previously linked to GlassWorm campaigns. This server then delivers encrypted JavaScript designed to steal cryptocurrency and sensitive data from victims.
Meanwhile, Socket noted the core threat actor has refined its techniques for improved evasion. The actor leverages extension dependencies in a transitive distribution model, as detailed in a previous report. Furthermore, Aikido Security attributed a separate mass repository compromise using invisible Unicode characters to the same actor.
The consistent use of the same Solana command infrastructure confirms ForceMemo is a new delivery vector for the established GlassWorm threat actor. StepSecurity emphasized the unique nature of this attack, stating “No other documented supply chain campaign uses this injection method” of silent force-pushing.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
